CVE-2013-0632 Adobe ColdFusion Authentication Bypass
Remote attackers can bypass authentication using default empty credentials in the RDS component to access the administrative interface and potentially execute arbitrary code.
- Exploited in the wild
- Since 3 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-0632?
CVE-2013-0632 is a critical authentication bypass vulnerability in Adobe Coldfusion, published on 17 Jan 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
Weakness: CWE-276
Which versions are affected by CVE-2013-0632?
It affects 1 product.
Products include Adobe Coldfusion.
How do I fix CVE-2013-0632?
No fix has been published for CVE-2013-0632 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Mar 2022.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2013-0632 being exploited?
Yes. Attackers have exploited CVE-2013-0632 in the wild since at least 3 Mar 2022.
Public exploit code: 1 Metasploit module and 3 Exploit-DB entries.
Other vulnerabilities in Adobe Coldfusion
- CVE-2026-48282 Adobe ColdFusion Path Traversal
- CVE-2023-38203 Adobe ColdFusion Deserialization of Untrusted Data
- CVE-2023-29300 Adobe ColdFusion Deserialization of Untrusted Data
- CVE-2023-26359 Adobe ColdFusion Deserialization of Untrusted Data
- CVE-2018-15961 Adobe ColdFusion Unrestricted File Upload
Sources
Also known as GHSA-8xf7-v5jv-237f.